@sureshgururajan/aws-console-private-access-validator 1.0.1 → 1.0.2

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,87 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { ConsolePrivateAccessValidator } from './validator.js';
+const server = new Server({
+    name: 'aws-console-private-access-validator',
+    version: '1.0.0',
+}, {
+    capabilities: {
+        tools: {},
+    },
+});
+const tools = [
+    {
+        name: 'validate-cloudformation',
+        description: 'Validates a CloudFormation template for AWS Console Private Access requirements',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                template: {
+                    type: 'string',
+                    description: 'CloudFormation template as JSON string',
+                },
+                region: {
+                    type: 'string',
+                    description: 'AWS region (default: us-east-1)',
+                    default: 'us-east-1',
+                },
+            },
+            required: ['template'],
+        },
+    },
+];
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools,
+}));
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    if (request.params.name === 'validate-cloudformation') {
+        const { template, region = 'us-east-1' } = request.params.arguments;
+        try {
+            const parsedTemplate = JSON.parse(template);
+            const validator = new ConsolePrivateAccessValidator(parsedTemplate, region);
+            const result = validator.validate();
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify(result, null, 2),
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({
+                            valid: false,
+                            checks: [],
+                            summary: `Error parsing template: ${errorMessage}`,
+                        }, null, 2),
+                    },
+                ],
+                isError: true,
+            };
+        }
+    }
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `Unknown tool: ${request.params.name}`,
+            },
+        ],
+        isError: true,
+    };
+});
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((error) => {
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAG/D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,sCAAsC;IAC5C,OAAO,EAAE,OAAO;CACjB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,MAAM,KAAK,GAAW;IACpB;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,iFAAiF;QACnF,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,wCAAwC;iBACtD;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,iCAAiC;oBAC9C,OAAO,EAAE,WAAW;iBACrB;aACF;YACD,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB;KACF;CACF,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK;CACN,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACtD,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,SAGzD,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,cAAc,GAA2B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;YAEpC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;4BACE,KAAK,EAAE,KAAK;4BACZ,MAAM,EAAE,EAAE;4BACV,OAAO,EAAE,2BAA2B,YAAY,EAAE;yBACnD,EACD,IAAI,EACJ,CAAC,CACF;qBACF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;aAC7C;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=test.d.ts.map

package/dist/test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../src/test.ts"],"names":[],"mappings":""}

package/dist/test.js

@@ -0,0 +1,26 @@
+import fs from 'fs';
+import { ConsolePrivateAccessValidator } from './validator.js';
+// Read the CloudFormation template
+const templatePath = process.argv[2] || '/tmp/template.json';
+const templateContent = fs.readFileSync(templatePath, 'utf-8');
+const template = JSON.parse(templateContent);
+// Run validation
+const validator = new ConsolePrivateAccessValidator(template, 'us-east-1');
+const result = validator.validate();
+// Print results
+console.log('\n=== AWS Console Private Access Validation Results ===\n');
+console.log(`Valid: ${result.valid ? '✓ YES' : '✗ NO'}\n`);
+console.log('Checks:');
+result.checks.forEach((check) => {
+    const icon = check.status === 'pass' ? '✓' : check.status === 'fail' ? '✗' : '⚠';
+    console.log(`  ${icon} ${check.name}`);
+    console.log(`    Status: ${check.status}`);
+    console.log(`    Message: ${check.message}`);
+    if (check.details) {
+        console.log(`    Details: ${check.details}`);
+    }
+});
+console.log(`\nSummary: ${result.summary}\n`);
+// Exit with appropriate code
+process.exit(result.valid ? 0 : 1);
+//# sourceMappingURL=test.js.map

package/dist/test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.js","sourceRoot":"","sources":["../src/test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE/D,mCAAmC;AACnC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;AAC7D,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AAE7C,iBAAiB;AACjB,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;AAEpC,gBAAgB;AAChB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;AACzE,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AAE3D,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACvB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;AAE9C,6BAA6B;AAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,17 @@
+export interface ValidationCheck {
+    name: string;
+    status: 'pass' | 'fail' | 'warning';
+    message: string;
+    details?: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    checks: ValidationCheck[];
+    summary: string;
+}
+export interface CloudFormationTemplate {
+    Resources?: Record<string, any>;
+    Outputs?: Record<string, any>;
+    Parameters?: Record<string, any>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAClC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/validator.d.ts

@@ -0,0 +1,19 @@
+import { ValidationResult, CloudFormationTemplate } from './types';
+export declare class ConsolePrivateAccessValidator {
+    private template;
+    private region;
+    private checks;
+    constructor(template: CloudFormationTemplate, region?: string);
+    validate(): ValidationResult;
+    private getServiceName;
+    private checkVpcEndpoints;
+    private checkEndpointPolicies;
+    private validatePolicyContent;
+    private checkRoute53HostedZones;
+    private checkSecurityGroups;
+    private checkEc2Instance;
+    private checkNatGateway;
+    private checkNetworkConfiguration;
+    private generateSummary;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../src/validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEpF,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAyB;gBAE3B,QAAQ,EAAE,sBAAsB,EAAE,MAAM,GAAE,MAAoB;IAK1E,QAAQ,IAAI,gBAAgB;IAqB5B,OAAO,CAAC,cAAc;IAwBtB,OAAO,CAAC,iBAAiB;IAiDzB,OAAO,CAAC,qBAAqB;IA8C7B,OAAO,CAAC,qBAAqB;IAe7B,OAAO,CAAC,uBAAuB;IAuC/B,OAAO,CAAC,mBAAmB;IAwB3B,OAAO,CAAC,gBAAgB;IAsBxB,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,yBAAyB;IAkCjC,OAAO,CAAC,eAAe;CAUxB"}

package/dist/validator.js

@@ -0,0 +1,234 @@
+export class ConsolePrivateAccessValidator {
+    constructor(template, region = 'us-east-1') {
+        this.checks = [];
+        this.template = template;
+        this.region = region;
+    }
+    validate() {
+        this.checks = [];
+        this.checkVpcEndpoints();
+        this.checkEndpointPolicies();
+        this.checkRoute53HostedZones();
+        this.checkSecurityGroups();
+        this.checkEc2Instance();
+        this.checkNatGateway();
+        this.checkNetworkConfiguration();
+        const failCount = this.checks.filter(c => c.status === 'fail').length;
+        const valid = failCount === 0;
+        return {
+            valid,
+            checks: this.checks,
+            summary: this.generateSummary(valid, failCount),
+        };
+    }
+    getServiceName(serviceName) {
+        if (typeof serviceName === 'string') {
+            return serviceName;
+        }
+        if (serviceName?.['Fn::Join']) {
+            const parts = serviceName['Fn::Join'][1];
+            if (Array.isArray(parts)) {
+                // Handle Ref to AWS::Region by replacing with actual region
+                return parts
+                    .map((part) => {
+                    if (typeof part === 'string') {
+                        return part;
+                    }
+                    if (part?.Ref === 'AWS::Region') {
+                        return this.region;
+                    }
+                    return '';
+                })
+                    .join('');
+            }
+        }
+        return null;
+    }
+    checkVpcEndpoints() {
+        const requiredEndpoints = [
+            { name: 'console', service: `com.amazonaws.${this.region}.console` },
+            { name: 'signin', service: `com.amazonaws.${this.region}.signin` },
+            { name: 'ssm', service: `com.amazonaws.${this.region}.ssm` },
+            { name: 'ec2messages', service: `com.amazonaws.${this.region}.ec2messages` },
+            { name: 'ssmmessages', service: `com.amazonaws.${this.region}.ssmmessages` },
+        ];
+        const resources = this.template.Resources || {};
+        const interfaceEndpoints = Object.values(resources).filter((r) => r.Type === 'AWS::EC2::VPCEndpoint' && r.Properties?.VpcEndpointType === 'Interface');
+        for (const endpoint of requiredEndpoints) {
+            const found = interfaceEndpoints.some((e) => {
+                const serviceName = this.getServiceName(e.Properties?.ServiceName);
+                return serviceName && serviceName.includes(endpoint.service);
+            });
+            this.checks.push({
+                name: `VPC Endpoint: ${endpoint.name}`,
+                status: found ? 'pass' : 'fail',
+                message: found
+                    ? `Interface VPC endpoint for ${endpoint.name} found`
+                    : `Missing interface VPC endpoint for ${endpoint.name}`,
+            });
+        }
+        // Check for S3 Gateway endpoint
+        const s3Gateway = Object.values(resources).some((r) => {
+            const serviceName = this.getServiceName(r.Properties?.ServiceName);
+            return (r.Type === 'AWS::EC2::VPCEndpoint' &&
+                r.Properties?.VpcEndpointType === 'Gateway' &&
+                serviceName &&
+                serviceName.includes('s3'));
+        });
+        this.checks.push({
+            name: 'VPC Endpoint: S3 Gateway',
+            status: s3Gateway ? 'pass' : 'fail',
+            message: s3Gateway ? 'S3 Gateway VPC endpoint found' : 'Missing S3 Gateway VPC endpoint',
+        });
+    }
+    checkEndpointPolicies() {
+        const resources = this.template.Resources || {};
+        const consoleEndpoint = Object.entries(resources).find(([_, r]) => {
+            const serviceName = this.getServiceName(r.Properties?.ServiceName);
+            return (r.Type === 'AWS::EC2::VPCEndpoint' &&
+                serviceName &&
+                serviceName.includes('console'));
+        });
+        const signinEndpoint = Object.entries(resources).find(([_, r]) => {
+            const serviceName = this.getServiceName(r.Properties?.ServiceName);
+            return (r.Type === 'AWS::EC2::VPCEndpoint' &&
+                serviceName &&
+                serviceName.includes('signin'));
+        });
+        for (const [name, endpoint] of [
+            ['Console', consoleEndpoint],
+            ['Signin', signinEndpoint],
+        ]) {
+            if (!endpoint)
+                continue;
+            const [_, resource] = endpoint;
+            const hasPolicy = resource.Properties?.PolicyDocument;
+            this.checks.push({
+                name: `Endpoint Policy: ${name}`,
+                status: hasPolicy ? 'pass' : 'fail',
+                message: hasPolicy
+                    ? `${name} endpoint has a policy attached`
+                    : `${name} endpoint is missing a policy`,
+                details: hasPolicy
+                    ? this.validatePolicyContent(resource.Properties.PolicyDocument)
+                    : undefined,
+            });
+        }
+    }
+    validatePolicyContent(policy) {
+        if (!policy.Statement || policy.Statement.length === 0) {
+            return 'Policy has no statements';
+        }
+        const statement = policy.Statement[0];
+        const hasAccountCondition = statement.Condition?.StringEquals?.['aws:PrincipalAccount'];
+        if (hasAccountCondition) {
+            return 'Policy restricts access to specific account(s)';
+        }
+        return 'Policy does not restrict access by account';
+    }
+    checkRoute53HostedZones() {
+        const resources = this.template.Resources || {};
+        const hostedZones = Object.values(resources).filter((r) => r.Type === 'AWS::Route53::HostedZone');
+        const requiredZones = ['console.aws.amazon.com', 'signin.aws.amazon.com'];
+        for (const zone of requiredZones) {
+            const found = hostedZones.some((hz) => {
+                const zoneName = hz.Properties?.Name;
+                // Route53 zone names may have a trailing dot
+                return zoneName === zone || zoneName === `${zone}.`;
+            });
+            this.checks.push({
+                name: `Route53 Hosted Zone: ${zone}`,
+                status: found ? 'pass' : 'fail',
+                message: found
+                    ? `Private hosted zone for ${zone} found`
+                    : `Missing private hosted zone for ${zone}`,
+            });
+        }
+        // Check for Route53 records
+        const recordSets = Object.values(resources).filter((r) => r.Type === 'AWS::Route53::RecordSet');
+        this.checks.push({
+            name: 'Route53 Records',
+            status: recordSets.length > 0 ? 'pass' : 'warning',
+            message: recordSets.length > 0
+                ? `Found ${recordSets.length} Route53 records`
+                : 'No Route53 records found',
+        });
+    }
+    checkSecurityGroups() {
+        const resources = this.template.Resources || {};
+        const securityGroups = Object.values(resources).filter((r) => r.Type === 'AWS::EC2::SecurityGroup');
+        const hasHttpsIngress = securityGroups.some((sg) => {
+            const ingress = sg.Properties?.SecurityGroupIngress || [];
+            return ingress.some((rule) => (rule.FromPort === 443 || rule.IpProtocol === 'tcp') &&
+                (rule.ToPort === 443 || rule.IpProtocol === 'tcp'));
+        });
+        this.checks.push({
+            name: 'Security Group: HTTPS Access',
+            status: hasHttpsIngress ? 'pass' : 'warning',
+            message: hasHttpsIngress
+                ? 'Security group allows HTTPS (port 443) traffic'
+                : 'No security group rule found for HTTPS (port 443)',
+        });
+    }
+    checkEc2Instance() {
+        const resources = this.template.Resources || {};
+        const instance = Object.values(resources).find((r) => r.Type === 'AWS::EC2::Instance');
+        this.checks.push({
+            name: 'EC2 Instance',
+            status: instance ? 'pass' : 'warning',
+            message: instance ? 'EC2 instance found' : 'No EC2 instance found (optional)',
+        });
+        if (instance) {
+            const hasIamRole = instance.Properties?.IamInstanceProfile;
+            this.checks.push({
+                name: 'EC2 IAM Role',
+                status: hasIamRole ? 'pass' : 'warning',
+                message: hasIamRole
+                    ? 'EC2 instance has IAM instance profile'
+                    : 'EC2 instance missing IAM instance profile',
+            });
+        }
+    }
+    checkNatGateway() {
+        const resources = this.template.Resources || {};
+        const natGateway = Object.values(resources).find((r) => r.Type === 'AWS::EC2::NatGateway');
+        this.checks.push({
+            name: 'NAT Gateway',
+            status: natGateway ? 'pass' : 'warning',
+            message: natGateway
+                ? 'NAT Gateway found for private subnet egress'
+                : 'No NAT Gateway found (required for private subnet internet access)',
+        });
+    }
+    checkNetworkConfiguration() {
+        const resources = this.template.Resources || {};
+        // Check for private subnets
+        const privateSubnets = Object.values(resources).filter((r) => r.Type === 'AWS::EC2::Subnet' &&
+            !r.Properties?.MapPublicIpOnLaunch);
+        this.checks.push({
+            name: 'Private Subnets',
+            status: privateSubnets.length > 0 ? 'pass' : 'fail',
+            message: privateSubnets.length > 0
+                ? `Found ${privateSubnets.length} private subnet(s)`
+                : 'No private subnets found',
+        });
+        // Check for route tables
+        const routeTables = Object.values(resources).filter((r) => r.Type === 'AWS::EC2::RouteTable');
+        this.checks.push({
+            name: 'Route Tables',
+            status: routeTables.length > 0 ? 'pass' : 'warning',
+            message: routeTables.length > 0
+                ? `Found ${routeTables.length} route table(s)`
+                : 'No route tables found',
+        });
+    }
+    generateSummary(valid, failCount) {
+        const passCount = this.checks.filter(c => c.status === 'pass').length;
+        const warningCount = this.checks.filter(c => c.status === 'warning').length;
+        if (valid) {
+            return `✓ Validation passed. All required checks passed (${passCount} passed, ${warningCount} warnings).`;
+        }
+        return `✗ Validation failed. ${failCount} check(s) failed, ${passCount} passed, ${warningCount} warnings.`;
+    }
+}
+//# sourceMappingURL=validator.js.map

package/dist/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../src/validator.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,6BAA6B;IAKxC,YAAY,QAAgC,EAAE,SAAiB,WAAW;QAFlE,WAAM,GAAsB,EAAE,CAAC;QAGrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,KAAK,CAAC,CAAC;QAE9B,OAAO;YACL,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC;SAChD,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,WAAgB;QACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,4DAA4D;gBAC5D,OAAO,KAAK;qBACT,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;oBACjB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC7B,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,IAAI,EAAE,GAAG,KAAK,aAAa,EAAE,CAAC;wBAChC,OAAO,IAAI,CAAC,MAAM,CAAC;oBACrB,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC;qBACD,IAAI,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,iBAAiB;QACvB,MAAM,iBAAiB,GAAG;YACxB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,MAAM,UAAU,EAAE;YACpE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,MAAM,SAAS,EAAE;YAClE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,MAAM,MAAM,EAAE;YAC5D,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,MAAM,cAAc,EAAE;YAC5E,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,MAAM,cAAc,EAAE;SAC7E,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAChD,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACxD,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,KAAK,WAAW,CAChG,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;gBAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACnE,OAAO,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,iBAAiB,QAAQ,CAAC,IAAI,EAAE;gBACtC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC/B,OAAO,EAAE,KAAK;oBACZ,CAAC,CAAC,8BAA8B,QAAQ,CAAC,IAAI,QAAQ;oBACrD,CAAC,CAAC,sCAAsC,QAAQ,CAAC,IAAI,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAC7C,CAAC,CAAM,EAAE,EAAE;YACT,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACnE,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,uBAAuB;gBAClC,CAAC,CAAC,UAAU,EAAE,eAAe,KAAK,SAAS;gBAC3C,WAAW;gBACX,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3B,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACnC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iCAAiC;SACzF,CAAC,CAAC;IACL,CAAC;IAEO,qBAAqB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAChD,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CACpD,CAAC,CAAC,CAAC,EAAE,CAAC,CAAgB,EAAE,EAAE;YACxB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACnE,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,uBAAuB;gBAClC,WAAW;gBACX,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAChC,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CACnD,CAAC,CAAC,CAAC,EAAE,CAAC,CAAgB,EAAE,EAAE;YACxB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACnE,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,uBAAuB;gBAClC,WAAW;gBACX,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC/B,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI;YAC7B,CAAC,SAAS,EAAE,eAAe,CAAC;YAC5B,CAAC,QAAQ,EAAE,cAAc,CAAC;SAC3B,EAAE,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,QAAyB,CAAC;YAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;YAEtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,oBAAoB,IAAI,EAAE;gBAChC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBACnC,OAAO,EAAE,SAAS;oBAChB,CAAC,CAAC,GAAG,IAAI,iCAAiC;oBAC1C,CAAC,CAAC,GAAG,IAAI,+BAA+B;gBAC1C,OAAO,EAAE,SAAS;oBAChB,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC;oBAChE,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,MAAW;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,0BAA0B,CAAC;QACpC,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,mBAAmB,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAExF,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,gDAAgD,CAAC;QAC1D,CAAC;QAED,OAAO,4CAA4C,CAAC;IACtD,CAAC;IAEO,uBAAuB;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACjD,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAClD,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,CAAC;QAE1E,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE;gBACzC,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC;gBACrC,6CAA6C;gBAC7C,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC;YACtD,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,wBAAwB,IAAI,EAAE;gBACpC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC/B,OAAO,EAAE,KAAK;oBACZ,CAAC,CAAC,2BAA2B,IAAI,QAAQ;oBACzC,CAAC,CAAC,mCAAmC,IAAI,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAChD,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CACjD,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAClD,OAAO,EACL,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC,SAAS,UAAU,CAAC,MAAM,kBAAkB;gBAC9C,CAAC,CAAC,0BAA0B;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACpD,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CACjD,CAAC;QAEF,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE;YACtD,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE,oBAAoB,IAAI,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,IAAS,EAAE,EAAE,CACZ,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC;gBACpD,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CACrD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC5C,OAAO,EAAE,eAAe;gBACtB,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,mDAAmD;SACxD,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC;QAE5F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACrC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kCAAkC;SAC9E,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,UAAU,GAAI,QAAgB,CAAC,UAAU,EAAE,kBAAkB,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACvC,OAAO,EAAE,UAAU;oBACjB,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,2CAA2C;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC;QAEhG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACvC,OAAO,EAAE,UAAU;gBACjB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,oEAAoE;SACzE,CAAC,CAAC;IACL,CAAC;IAEO,yBAAyB;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAEhD,4BAA4B;QAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACpD,CAAC,CAAM,EAAE,EAAE,CACT,CAAC,CAAC,IAAI,KAAK,kBAAkB;YAC7B,CAAC,CAAC,CAAC,UAAU,EAAE,mBAAmB,CACrC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACnD,OAAO,EACL,cAAc,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,CAAC,SAAS,cAAc,CAAC,MAAM,oBAAoB;gBACpD,CAAC,CAAC,0BAA0B;SACjC,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACjD,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAC9C,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACnD,OAAO,EACL,WAAW,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,SAAS,WAAW,CAAC,MAAM,iBAAiB;gBAC9C,CAAC,CAAC,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,KAAc,EAAE,SAAiB;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAE5E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,oDAAoD,SAAS,YAAY,YAAY,aAAa,CAAC;QAC5G,CAAC;QAED,OAAO,wBAAwB,SAAS,qBAAqB,SAAS,YAAY,YAAY,YAAY,CAAC;IAC7G,CAAC;CACF"}

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@sureshgururajan/aws-console-private-access-validator",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "type": "module",
   "description": "MCP server for validating AWS Console Private Access CloudFormation templates",
   "main": "dist/index.js",
+  "bin": {
+    "aws-console-private-access-validator": "dist/index.js"
+  },
   "scripts": {
     "build": "tsc",
     "start": "node dist/index.js",
@@ -23,3 +26,4 @@
   }
 }
 
+